修复Maven与Gradle同根检查归属及漏洞反馈覆盖

Author: loong10k

README.md

@@ -989,3 +989,7 @@ flowchart LR
     I --> J[Agent feedback and original native verification]
     J --> K[Closure requires accepted native repair evidence]
 ```
+
+## Maven and Gradle in the same build root
+
+Static discovery now retains every Maven/Groovy-Gradle/Kotlin-Gradle configuration reference in a shared physical directory. A malformed POM cannot hide Gradle, and two Gradle build scripts remain separate observations. Java dependency/CVE/security aggregates keep the mixed-build or unresolved-Gradle condition and no global Maven checker identity; any available Maven-local dependency graph and advisory observations remain in `native_results`. Check feedback0.61 preserves closed normal-check and lint-only contracts, including narrowly constrained Java comments `not_configured`; prior schemas remain unchanged. This fixes scope attribution, not native Gradle plugin execution or production acceptance. The local cached Gradle8.10.2 version command ran, while the inspected OWASP Gradle plugin cache paths were absent; no installation/download was performed. See [acceptance](tests/acceptance/java-mixed-build-roots.md).

README.zh-CN.md

@@ -972,3 +972,7 @@ flowchart LR
     I --> J[智能体反馈与原工具复检]
     J --> K[关闭仍需通过原生修复验收]
 ```
+
+## 同构建根的 Maven 与 Gradle 归属
+
+静态发现现逐份保留同一物理目录的Maven、Groovy Gradle、Kotlin Gradle配置引用。损坏POM不能遮蔽Gradle，两种Gradle脚本并存也分别保留。Java依赖/CVE/安全类别保留构建器混合或Gradle未解析状态，不再挂全范围Maven身份；已经取得的Maven局部依赖图和漏洞观察仍放在native_results。check反馈0.61保留普通检查/lint-only两个封闭契约，Java注释not_configured原因严格限于对应类别，旧schema不改。这是范围归属修复，不是原生Gradle插件执行或生产验收完成。本地缓存Gradle8.10.2版本命令已实际运行，所检查OWASP Gradle插件缓存路径不存在，本批未安装或下载。见[验收记录](tests/acceptance/java-mixed-build-roots.md)。

crates/codeguard-cli/src/check_command.rs

@@ -1461,6 +1461,20 @@ fn run_scoped(args: &[String], lint_only: bool) -> ExitCode {
                 "status": if observed { "observed_unverified" } else if npm_selected || python_lint_selected || rust_lint_selected || rust_comments_selected || rust_build_selected || rust_cve_selected || go_lint_selected || java_lint_selected || java_comments_selected || (language == "java" && category == "dependencies" && dependency_configured) || (cve_scope_configured) { "native_incomplete" } else if language == "java" && category == "comments" { if javadoc_configuration_unresolved { "configuration_unresolved" } else { "not_configured" } } else if let Some(candidate) = java_checker.as_ref() { candidate.status } else { "not_integrated" },
                 "reason": if rust_cve_selected { if observed { "rust_cve_database_freshness_unverified" } else { "rust_cve_native_incomplete" } } else if npm_selected { "npm_advisory_coverage_and_freshness_unverified" } else if planned_language { "planned_language_adapter_gap" } else if observed { "trusted_policy_and_coverage_unavailable" } else if java_lint_selected && java_p3c["local_observation_complete"] == true { "p3c_declared_rulesets_unverified_coverage" } else if java_comments_selected && java_javadoc["maven_multifile_probes"].as_array().is_some_and(|probes| probes.iter().any(|probe| matches!(probe["observation"]["native_status"].as_str(), Some("findings_observed_untrusted" | "clean_log_unverified")))) { "javadoc_multifile_probe_unverified_project_coverage" } else if java_comments_selected && java_javadoc["local_probe_complete"] == true { "javadoc_single_file_probe_unverified_coverage" } else if language == "java" && category == "dependencies" && java_dependencies["observed_graph_count"].as_u64().is_some_and(|count| count > 0) { "dependency_graph_observed_unverified_coverage" } else if cve_scope_configured && java_cve["observed_report_count"].as_u64().is_some_and(|count| count > 0) { "cve_report_observed_database_unverified" } else if (language == "java" && category == "dependencies" && dependency_configured) || cve_scope_configured || python_lint_selected || rust_lint_selected || rust_comments_selected || rust_build_selected || go_lint_selected || java_lint_selected || java_comments_selected { "native_scan_incomplete" } else if language == "java" && category == "comments" { if javadoc_configuration_unresolved { "javadoc_configuration_unresolved" } else { "not_configured" } } else if let Some(candidate) = java_checker.as_ref() { candidate.reason } else { "native_adapter_not_integrated" }
             });
+            // 原生Maven局部结果继续保留，但不能覆盖同一源码范围的Gradle未解析义务。
+            if let Some(scope) = java_checker.as_ref().filter(|scope| {
+                language == "java"
+                    && matches!(category, "dependencies" | "cve" | "security")
+                    && matches!(
+                        scope.reason,
+                        "checker_build_systems_mixed" | "gradle_model_not_resolved"
+                    )
+            }) {
+                candidate["checker_id"] = json!(scope.checker_id);
+                candidate["status"] = json!(scope.status);
+                candidate["reason"] = json!(scope.reason);
+                candidate["next_action"] = json!(scope.next_action);
+            }
             if language == "kotlin" && category == "lint" && kotlin_lint.is_object() {
                 candidate["checker_id"] = json!("kotlin.jvm.compiler");
                 candidate["status"] = json!("native_incomplete");
@@ -2108,8 +2122,12 @@ fn run_scoped(args: &[String], lint_only: bool) -> ExitCode {
     if shell_lint.is_object() {
         crate::check_shell_scan::refresh(&root, &mut shell_lint, deadline);
     }
+    let gradle_model_unresolved = discovery
+        .checker_configurations
+        .iter()
+        .any(|entry| entry.checker_id.starts_with("java.gradle."));
     let mut report = json!({
-        "schema_version":if next["schema_version"] == "0.21.0" || syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row|row.get("javascript_mode_observation").is_some())) {"0.60.0"}else if lint_only {"0.59.0"}else if next["repair_brief"]["checker_id"] == "java.maven.p3c" && next["repair_brief"]["reason_code"] == "p3c_configuration_not_confirmed" {"0.58.0"}else if next["repair_brief"]["checker_id"] == "java.maven.javadoc" {"0.57.0"}else if next["repair_brief"]["checker_id"] == "rust.cargo_clippy" {"0.56.0"}else if syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row| row["language"]=="erlang" && row.get("structural_observations").is_some())) {"0.55.0"} else if next["schema_version"] == "0.20.0" || syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row| row["language"]=="javascript" && row.get("structural_observations").is_some())) {"0.54.0"}else if syntax_candidates["observations"].as_array().is_some_and(|rows|rows.iter().any(|row|row["language"]=="cfquery")) {"0.53.0"}else if shell_lint.is_object() || next["schema_version"]=="0.17.0" {"0.52.0"}else if ruby_lint.is_object() || next["schema_version"] == "0.15.0" {"0.51.0"} else if next["schema_version"] == "0.14.0" {"0.50.0"} else if next["schema_version"] == "0.13.0" || syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row| row["language"] == "go" && row.get("structural_observations").is_some())) {"0.49.0"} else if syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row| row.get("structural_observations").is_some())) {"0.48.0"} else if zig_lint["schema_version"] == "0.2.0" || next["schema_version"] == "0.12.0" {"0.47.0"}else if zig_lint.is_object() {"0.46.0"} else if matches!(parsed.selection, Selection::Language(_)) {"0.45.0"} else if swift_lint["schema_version"] == "0.2.0" || next["schema_version"] == "0.11.0" {"0.44.0"} else if swift_lint.is_object() {"0.43.0"} else if kotlin_lint.is_object() || next["schema_version"] == "0.10.0" {"0.42.0"} else if matches!(next["schema_version"].as_str(), Some("0.8.0" | "0.9.0")) {"0.41.0"} else if next["schema_version"] == "0.7.0" {"0.40.0"} else if next["schema_version"] == "0.6.0" {"0.39.0"} else {"0.38.0"}, "report_type":"check_feedback",
+        "schema_version":if gradle_model_unresolved {"0.61.0"}else if next["schema_version"] == "0.21.0" || syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row|row.get("javascript_mode_observation").is_some())) {"0.60.0"}else if lint_only {"0.59.0"}else if next["repair_brief"]["checker_id"] == "java.maven.p3c" && next["repair_brief"]["reason_code"] == "p3c_configuration_not_confirmed" {"0.58.0"}else if next["repair_brief"]["checker_id"] == "java.maven.javadoc" {"0.57.0"}else if next["repair_brief"]["checker_id"] == "rust.cargo_clippy" {"0.56.0"}else if syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row| row["language"]=="erlang" && row.get("structural_observations").is_some())) {"0.55.0"} else if next["schema_version"] == "0.20.0" || syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row| row["language"]=="javascript" && row.get("structural_observations").is_some())) {"0.54.0"}else if syntax_candidates["observations"].as_array().is_some_and(|rows|rows.iter().any(|row|row["language"]=="cfquery")) {"0.53.0"}else if shell_lint.is_object() || next["schema_version"]=="0.17.0" {"0.52.0"}else if ruby_lint.is_object() || next["schema_version"] == "0.15.0" {"0.51.0"} else if next["schema_version"] == "0.14.0" {"0.50.0"} else if next["schema_version"] == "0.13.0" || syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row| row["language"] == "go" && row.get("structural_observations").is_some())) {"0.49.0"} else if syntax_candidates["observations"].as_array().is_some_and(|rows| rows.iter().any(|row| row.get("structural_observations").is_some())) {"0.48.0"} else if zig_lint["schema_version"] == "0.2.0" || next["schema_version"] == "0.12.0" {"0.47.0"}else if zig_lint.is_object() {"0.46.0"} else if matches!(parsed.selection, Selection::Language(_)) {"0.45.0"} else if swift_lint["schema_version"] == "0.2.0" || next["schema_version"] == "0.11.0" {"0.44.0"} else if swift_lint.is_object() {"0.43.0"} else if kotlin_lint.is_object() || next["schema_version"] == "0.10.0" {"0.42.0"} else if matches!(next["schema_version"].as_str(), Some("0.8.0" | "0.9.0")) {"0.41.0"} else if next["schema_version"] == "0.7.0" {"0.40.0"} else if next["schema_version"] == "0.6.0" {"0.39.0"} else {"0.38.0"}, "report_type":"check_feedback",
         "operation":"check", "selection":parsed.selection.as_str(), "command_status":if request_cancelled { "cancelled" } else { "incomplete" },
         "exit_code":if request_cancelled { 130 } else { 3 }, "delivery_decision":if parsed.selection == Selection::All { "incomplete" } else { "not_evaluated" }, "authority":"local_unverified",
         "reason":if request_cancelled { "request_cancelled" } else if parsed.selection == Selection::All { "full_project_obligations_and_trusted_policy_unavailable" } else if parsed.selection == Selection::Java { "java_selection_obligations_and_trusted_policy_unavailable" } else { "language_selection_obligations_and_trusted_policy_unavailable" },
@@ -2144,6 +2162,7 @@ fn run_scoped(args: &[String], lint_only: bool) -> ExitCode {
                     | "0.58.0"
                     | "0.59.0"
                     | "0.60.0"
+                    | "0.61.0"
             )
         )
     {
@@ -2172,6 +2191,7 @@ fn run_scoped(args: &[String], lint_only: bool) -> ExitCode {
                 | "0.58.0"
                 | "0.59.0"
                 | "0.60.0"
+                | "0.61.0"
         )
     ) {
         if let Some(native) = report["native_results"].as_object_mut() {
@@ -2199,6 +2219,7 @@ fn run_scoped(args: &[String], lint_only: bool) -> ExitCode {
                 | "0.58.0"
                 | "0.59.0"
                 | "0.60.0"
+                | "0.61.0"
         )
     ) {
         if let Some(native) = report["native_results"].as_object_mut() {
@@ -2218,6 +2239,7 @@ fn run_scoped(args: &[String], lint_only: bool) -> ExitCode {
                 | "0.58.0"
                 | "0.59.0"
                 | "0.60.0"
+                | "0.61.0"
         )
     ) {
         report["native_results"]["ruby_lint"] = ruby_lint.clone();
@@ -2234,6 +2256,7 @@ fn run_scoped(args: &[String], lint_only: bool) -> ExitCode {
                 | "0.58.0"
                 | "0.59.0"
                 | "0.60.0"
+                | "0.61.0"
         )
     ) {
         report["native_results"]["shell_lint"] = shell_lint.clone();

crates/codeguard-cli/src/discovery.rs

@@ -250,9 +250,11 @@ pub fn discover<P: ObservationPort>(
                             .extend(inspect_maven_unreadable(build_root, manifest));
                     }
                 }
-            } else if let Some(manifest) = manifests
+            }
+            // 同根多构建器逐份保留身份，POM观察不能遮蔽Gradle脚本或其未解析义务。
+            for manifest in manifests
                 .iter()
-                .find(|name| name.ends_with("build.gradle") || name.ends_with("build.gradle.kts"))
+                .filter(|name| name.ends_with("build.gradle") || name.ends_with("build.gradle.kts"))
             {
                 report
                     .checker_configurations

crates/codeguard-cli/tests/check_java_cve_attribution.rs

@@ -90,6 +90,21 @@ fi
             ])
             .output()
             .unwrap();
+        if let Some(dir) = std::env::var_os("CODEGUARD_JAVA_MIXED_BUILD_REPORT_DIR") {
+            let value: Value = serde_json::from_slice(&output.stdout).unwrap();
+            if value["schema_version"] == "0.61.0" {
+                fs::create_dir_all(&dir).unwrap();
+                fs::write(
+                    PathBuf::from(dir).join(format!(
+                        "native-attribution-{}-{}.json",
+                        std::process::id(),
+                        NEXT.fetch_add(1, Ordering::Relaxed)
+                    )),
+                    &output.stdout,
+                )
+                .unwrap();
+            }
+        }
         (
             output.status.code().unwrap(),
             serde_json::from_slice(&output.stdout).unwrap(),
@@ -157,3 +172,35 @@ fn same_pom_native_reports_produce_exact_digest_candidate_only() {
     );
     assert!(!private.to_string().contains("private.example"));
 }
+
+#[test]
+fn mixed_build_root_keeps_maven_native_evidence_without_assigning_it_to_gradle() {
+    let project = Project::new();
+    fs::write(project.0.join("build.gradle.kts"), b"plugins { java }\n").unwrap();
+    let digest = format!("{:x}", Sha256::digest(b"artifact-bytes"));
+    let (exit, report, stderr) = project.check(&digest, false);
+    assert_eq!(exit, 3, "{stderr}");
+    assert_eq!(
+        report["native_results"]["java_cve"]["observed_report_count"], 1,
+        "{report}"
+    );
+    assert_eq!(
+        report["native_results"]["java_dependencies"]["observed_graph_count"], 1,
+        "{report}"
+    );
+    assert_eq!(
+        report["native_results"]["java_cve"]["probes"][0]["observation"]["advisories"][0]["advisory_id"],
+        "CVE-2026-1234"
+    );
+    for category in ["cve", "dependencies", "security"] {
+        let row = report["category_candidates"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .find(|row| row["language"] == "java" && row["category"] == category)
+            .unwrap();
+        assert_eq!(row["checker_id"], Value::Null, "{report}");
+        assert_eq!(row["status"], "configuration_unresolved", "{report}");
+        assert_eq!(row["reason"], "checker_build_systems_mixed", "{report}");
+    }
+}